MCP drops sessions as the protocol goes stateless on 28 July
The MCP protocol removes sessions and the initialize handshake on 28th July 2026, and the GitHub MCP Server already supports the new spec ahead of that release.
What is changing
According to GitHub's changelog, MCP itself is moving to a stateless design on 28th July 2026, and the GitHub MCP Server already works ahead of that official switch-over date. GitHub describes the new stateless core as a way to make scaling MCP deployments simpler, and says it opens room for extensions such as MCP apps and Enterprise Managed Auth, both of which VS Code already supports.
What is removed and what stays
Sessions and the initialize step are both removed from the protocol. That lets a client connect to a server faster and easier, and clients can complete the handshake in parallel instead of one step at a time. On the compatibility side, every tier 1 SDK has preserved backward compatibility and has already shipped beta support for the new spec, so, per GitHub, teams do not need to do anything to keep their existing integrations working. The new protocol version also supports more remote servers offering features like elicitation, thanks to multi round-trip requests.
What GitHub changed on its own server
GitHub made three changes to its own MCP Server. It removed Redis sessions, so database writes on initialize and database reads on every call are both gone, which GitHub says makes things snappier without users losing anything. It avoided deep packet inspection: the new spec lets GitHub read the values it needs for logging and secret scanning straight from HTTP headers guaranteed to be present, instead of inspecting the payload of every request before the SDK does. It also upgraded its elicitation implementation; the stdio MCP server uses URL elicitation for user login, and in the new protocol version each step is a separate HTTP request, so the official Go SDK provides a wrapper that makes both the old and new mechanisms work together.
New conformance tests
MCP also added official conformance tests as part of this transition. Strict validation like this helps agents verify their own work, and GitHub suggests pointing Copilot at a codebase along with the draft spec documentation and any tier 1 SDK implementation to use them. GitHub frames this as a boost for the whole ecosystem, since AI-assisted development is easier to verify against a shared conformance suite, not just for the official SDK but for other clients and servers too.
Key facts
- The MCP protocol becomes stateless on 28th July 2026; sessions and the initialize step are removed.
- Clients can complete the connection handshake in parallel instead of sequentially.
- GitHub's MCP Server, built on the official Go SDK, already supports the new spec ahead of the official release.
- GitHub removed its own Redis-backed sessions, cutting database writes on initialize and database reads on every call.
- All tier 1 SDKs preserve backward compatibility and have already shipped beta support for the new spec.
What you can check now
If you run or depend on an MCP server, check whether it is built on a tier 1 SDK, since GitHub says those have already shipped beta support for the new spec with backward compatibility intact. If you maintain your own server, look at whether you can move logging and secret-scanning checks to read straight from HTTP headers instead of inspecting every request payload, the same change GitHub made. Teams building conformance checks into their pipeline can point their own client or server implementation at the draft spec documentation and a tier 1 SDK implementation to validate against the new official conformance tests.
Check your understanding
- What two protocol features does the new stateless MCP core remove?
- What three changes did GitHub make to its own MCP Server for the new spec?
- Why does GitHub say teams do not need to do anything to keep their existing MCP integrations working?